@wbce-d9/api 11.0.5 → 11.1.0

package/dist/constants.js

@@ -56,8 +56,12 @@ export const REFRESH_COOKIE_OPTIONS = {
     sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
     path: '/auth',
 };
-const { maxAge: refreshCookieMaxAge, expires: refreshCookieExpires, ...refresh_cookie_clear_options } = REFRESH_COOKIE_OPTIONS;
-export const REFRESH_COOKIE_CLEAR_OPTIONS = refresh_cookie_clear_options;
+export const REFRESH_COOKIE_CLEAR_OPTIONS = (() => {
+    const { ...rest } = REFRESH_COOKIE_OPTIONS;
+    delete rest.maxAge;
+    delete rest.expires;
+    return rest;
+})();
 export const GET_SET_HEADER = (cookieValue) => {
     const domainHeader = env['REFRESH_TOKEN_COOKIE_DOMAIN'] ? ` Domain=${env['REFRESH_TOKEN_COOKIE_DOMAIN']};` : '';
     const partitionedHeader = env['REFRESH_TOKEN_COOKIE_PARTITIONED'] == true ? ' Partitioned;' : '';
@@ -70,10 +74,14 @@ export const ACCESS_COOKIE_OPTIONS = {
     maxAge: getMilliseconds(env['ACCESS_TOKEN_TTL']),
     secure: env['ACCESS_TOKEN_COOKIE_SECURE'] ?? false,
     sameSite: env['ACCESS_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-    path: '/',
+    path: '/assets',
 };
-const { maxAge: accessCookieMaxAge, expires: accessCookieExpires, ...access_cookie_clear_options } = ACCESS_COOKIE_OPTIONS;
-export const ACCESS_COOKIE_CLEAR_OPTIONS = access_cookie_clear_options;
+export const ACCESS_COOKIE_CLEAR_OPTIONS = (() => {
+    const { ...rest } = ACCESS_COOKIE_OPTIONS;
+    delete rest.maxAge;
+    delete rest.expires;
+    return rest;
+})();
 export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];

package/dist/middleware/extract-token.js

@@ -22,7 +22,9 @@ const extractToken = (req, _res, next) => {
     /**
      * Check if there is an access token stored in the cookies
      */
-    if (req?.cookies?.[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+    if (req?.cookies?.[env['ACCESS_TOKEN_COOKIE_NAME']] &&
+        req.path.startsWith('/assets/') &&
+        req.method === 'GET') {
         token = req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']];
     }
     /**

package/dist/request/validate-ip.js

@@ -1,20 +1,70 @@
+import { BlockList } from 'net';
 import os from 'node:os';
 import { getEnv } from '../env.js';
+import logger from '../logger.js';
 export const validateIP = async (ip, url) => {
     const env = getEnv();
-    if (env['IMPORT_IP_DENY_LIST'].includes(ip)) {
-        throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+    const ipDenyList = env['IMPORT_IP_DENY_LIST'] || [];
+    // Create a BlockList for efficient IP range checking
+    const blockList = new BlockList();
+    // Add all denied ranges to the block list
+    for (const deniedRange of ipDenyList) {
+        if (deniedRange.includes('/')) {
+            // CIDR notation
+            const parts = deniedRange.split('/');
+            const network = parts[0];
+            const prefixLengthStr = parts[1];
+            if (!network || !prefixLengthStr) {
+                throw new Error('Invalid CIDR format: missing network or prefix');
+            }
+            const prefixLength = parseInt(prefixLengthStr, 10);
+            if (isNaN(prefixLength)) {
+                throw new Error('Invalid CIDR format: prefix length must be a number');
+            }
+            blockList.addSubnet(network, prefixLength);
+        }
+        else {
+            // Single IP address
+            blockList.addAddress(deniedRange);
+        }
     }
-    if (env['IMPORT_IP_DENY_LIST'].includes('0.0.0.0')) {
+    // Special case: "0.0.0.0" blocks all local interfaces AND loopback addresses
+    if (ipDenyList.includes('0.0.0.0')) {
+        // Add the entire loopback range (127.0.0.0/8) to fix the vulnerability
+        // This blocks all 127.x.x.x addresses, not just 127.0.0.1
+        blockList.addSubnet('127.0.0.0', 8);
+        // Add local network interfaces
         const networkInterfaces = os.networkInterfaces();
         for (const networkInfo of Object.values(networkInterfaces)) {
             if (!networkInfo)
                 continue;
             for (const info of networkInfo) {
-                if (info.address === ip) {
-                    throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+                if (info.internal && info.cidr) {
+                    try {
+                        const parts = info.cidr.split('/');
+                        const network = parts[0];
+                        const prefixLengthStr = parts[1];
+                        if (!network || !prefixLengthStr) {
+                            logger.warn(`Warning: Invalid local interface CIDR format "${info.cidr}": missing network or prefix`);
+                            continue;
+                        }
+                        const prefixLength = parseInt(prefixLengthStr, 10);
+                        if (isNaN(prefixLength)) {
+                            logger.warn(`Warning: Invalid prefix length in CIDR "${info.cidr}"`);
+                            continue;
+                        }
+                        blockList.addSubnet(network, prefixLength);
+                    }
+                    catch (error) {
+                        // Log but don't fail for invalid local interface CIDR
+                        logger.warn(`Warning: Invalid local interface CIDR "${info.cidr}": ${error instanceof Error ? error.message : 'Unknown error'}`);
+                    }
                 }
             }
         }
     }
+    // Check if the IP is blocked
+    if (blockList.check(ip)) {
+        throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+    }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "11.0.5",
+  "version": "11.1.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -143,20 +143,20 @@
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
     "wellknown": "0.5.0",
-    "@wbce-d9/exceptions": "9.26.4",
-    "@wbce-d9/extensions-sdk": "9.27.1",
+    "@wbce-d9/app": "9.33.2",
     "@wbce-d9/constants": "9.28.0",
+    "@wbce-d9/schema": "9.26.4",
     "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/exceptions": "9.26.4",
     "@wbce-d9/storage": "9.26.4",
-    "@wbce-d9/app": "9.33.1",
-    "@wbce-d9/schema": "9.26.4",
-    "@wbce-d9/storage-driver-azure": "9.26.8",
-    "@wbce-d9/storage-driver-cloudinary": "9.27.1",
-    "@wbce-d9/storage-driver-gcs": "9.26.8",
-    "@wbce-d9/storage-driver-local": "9.26.8",
-    "@wbce-d9/storage-driver-s3": "9.26.10",
+    "@wbce-d9/storage-driver-azure": "9.26.9",
+    "@wbce-d9/extensions-sdk": "9.27.2",
+    "@wbce-d9/storage-driver-gcs": "9.26.9",
+    "@wbce-d9/storage-driver-s3": "9.26.11",
+    "@wbce-d9/storage-driver-local": "9.26.9",
     "@wbce-d9/update-check": "9.28.0",
-    "@wbce-d9/utils": "9.29.1"
+    "@wbce-d9/storage-driver-cloudinary": "9.27.2",
+    "@wbce-d9/utils": "9.29.2"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -199,7 +199,7 @@
     "@vitest/coverage-c8": "0.30.1",
     "@wbce-d9/tsconfig": "0.0.7",
     "copyfiles": "2.4.1",
-    "form-data": "4.0.0",
+    "form-data": "4.0.4",
     "knex-mock-client": "3.0.2",
     "supertest": "6.3.3",
     "typescript": "5.0.4",